CVE-2016-5422

High

Published: 07/09/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The web console in Red Hat JBoss Operations Network (JON) before version 3.3.7 does not properly authorize requests to add users with the super user role, allowing remote authenticated users to gain admin privileges via a crafted POST request.

Risk Assessment

This vulnerability may lead to unauthorized access to administrative resources, posing a serious security threat to the system.

Recommendation

It is recommended to update Red Hat JBoss Operations Network to version 3.3.7 or later to mitigate this authorization flaw.

Other vulnerabilities in Red Hat JBoss Operations Network

CVE-2015-0297High
Red Hat JBoss Operations Network version 3.3.1 does not properly restrict access to certain APIs, allowing remote attackers to execute arbitrary Java methods via (1) ServerInvokerServlet or (2) SchedulerService, or cause a denial of service (disk consumption) via ContentManager.

Original NVD description (English source)

The web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request.